Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @bingads-webui-help/apex.core.v3.min (npm) MAL-2026-1588 | Malicious | Not scored | 18 Mar, 2026 | npm @bingads-webui-help/apex.core.v3.min |
Malicious release: Malicious code in @bingads-webui-cc-react/edit-primary-contact (npm) MAL-2026-1587 | Malicious | Not scored | 18 Mar, 2026 | npm @bingads-webui-cc-react/edit-primary-contact |
Malicious release: Malicious code in @at-point/valiant-widgets-v2 (npm) MAL-2026-1586 | Malicious | Not scored | 18 Mar, 2026 | npm @at-point/valiant-widgets-v2 |
Malicious release: Malicious code in @anchor-ds/core (npm) GHSA-w4ff-rwjv-9xxj, MAL-2026-1585 | Malicious | Not scored | 18 Mar, 2026 | npm @anchor-ds/core |
Malicious release: Malicious code in bugbounty-test-123 (npm) MAL-2026-1542 | Malicious | Not scored | 18 Mar, 2026 | npm bugbounty-test-123 |
music-metadata has an infinite loop vulnerability in ASF parser CVE-2026-32256, GHSA-v6c2-xwv6-8xf7 | High | 0.4% | 17 Mar, 2026 | npm music-metadata |
Parse Server affected by empty authData bypassing credential requirement on signup BIT-parse-2026-33042, CVE-2026-33042, GHSA-wjqw-r9x4-j59v | Medium | 0.3% | 17 Mar, 2026 | npm parse-server |
fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278) CVE-2026-33036, GHSA-8gc5-j5rx-235r | High | 0.6% | 17 Mar, 2026 | npm fast-xml-parser |
Nest Fastify HEAD Request Middleware Bypass CVE-2026-33011, GHSA-wf42-42fg-fg84 | High | 0.4% | 17 Mar, 2026 | npm @nestjs/platform-fastify |
Parse Server LiveQuery subscription with invalid regular expression crashes server BIT-parse-2026-32770, CVE-2026-32770, GHSA-827p-g5x5-h86c | High | 0.6% | 17 Mar, 2026 | npm parse-server |
Parse Server session creation endpoint allows overwriting server-generated session fields BIT-parse-2026-32742, CVE-2026-32742, GHSA-5v7g-9h8f-8pgg | Medium | 0.3% | 17 Mar, 2026 | npm parse-server |
Parse Server vulnerable to schema poisoning via prototype pollution in deep copy BIT-parse-2026-32878, CVE-2026-32878, GHSA-9ccr-fpp6-78qf | Medium | 0.4% | 17 Mar, 2026 | npm parse-server |
Parse Server's Cloud function dispatch crashes server via prototype chain traversal BIT-parse-2026-32886, CVE-2026-32886, GHSA-4263-jgmp-7pf4 | High | 0.5% | 17 Mar, 2026 | npm parse-server |
Parse Server has a password reset token single-use bypass via concurrent requests BIT-parse-2026-32943, CVE-2026-32943, GHSA-r3xq-68wh-gwvh | Low | 0.2% | 17 Mar, 2026 | npm parse-server |
Parse Server crash via deeply nested query condition operators BIT-parse-2026-32944, CVE-2026-32944, GHSA-9xp9-j92r-p88v | High | 0.5% | 17 Mar, 2026 | npm parse-server |
jsPDF has HTML Injection in New Window paths CVE-2026-31938, GHSA-wfv2-pwc8-crg5 | Critical | 0.3% | 17 Mar, 2026 | npm jspdf |
jsPDF has a PDF Object Injection via FreeText color CVE-2026-31898, GHSA-7x6v-j9x4-qf24 | High | 0.4% | 17 Mar, 2026 | npm jspdf |
Elysia Cookie Value Prototype Pollution CVE-2026-31865, GHSA-8hq9-phh3-p2wp | Medium | 0.2% | 17 Mar, 2026 | npm elysia |
Next.js: HTTP request smuggling in rewrites CVE-2026-29057, GHSA-ggv3-7p47-pfv8 | Medium | 0.5% | 17 Mar, 2026 | npm next |
Next.js: Unbounded next/image disk cache growth can exhaust storage CVE-2026-27980, GHSA-3x4c-7xq6-9pq8 | Medium | 0.7% | 17 Mar, 2026 | npm next |
Next.js: Unbounded postponed resume buffering can lead to DoS CVE-2026-27979, GHSA-h27x-g6w4-24gq | Medium | 0.7% | 17 Mar, 2026 | npm next |
Next.js: null origin can bypass Server Actions CSRF checks CVE-2026-27978, GHSA-mq59-m269-xvcx | Medium | 0.2% | 17 Mar, 2026 | npm next |
Next.js: null origin can bypass dev HMR websocket CSRF checks CVE-2026-27977, GHSA-jcc7-9wpm-mj36 | Low | 0.2% | 17 Mar, 2026 | npm next |
Malicious release: Malicious code in whatfix-icons (npm) MAL-2026-1495 | Malicious | Not scored | 17 Mar, 2026 | npm whatfix-icons |
sjcl is missing point-on-curve validation in sjcl.ecc.basicKey.publicKey CVE-2026-4258, GHSA-2w8x-224x-785m | High | 0.3% | 17 Mar, 2026 | npm sjcl |
Malicious release: Malicious code in navi-design-system (npm) MAL-2026-1494 | Malicious | Not scored | 17 Mar, 2026 | npm navi-design-system |
Malicious release: Malicious code in pino-logger-utils (npm) GHSA-9vc6-vqg8-v9x5, MAL-2026-1493 | Malicious | Not scored | 17 Mar, 2026 | npm pino-logger-utils |
Malicious release: Malicious code in strapi-plugin-workspace-plugin (npm) GHSA-7cc2-4g9h-6fxf, MAL-2026-1492 | Malicious | Not scored | 17 Mar, 2026 | npm strapi-plugin-workspace-plugin |
Malicious release: Malicious code in ember-power-calendar-utils (npm) GHSA-mcfw-v5xh-957q, MAL-2026-1490 | Malicious | Not scored | 17 Mar, 2026 | npm ember-power-calendar-utils |
Malicious release: Malicious code in asset-delivery (npm) GHSA-w6x5-44p2-gjvf, MAL-2026-1489 | Malicious | Not scored | 17 Mar, 2026 | npm asset-delivery |
Malicious release: Malicious code in graphlib-js (npm) GHSA-mfcc-4344-rj22, MAL-2026-1491 | Malicious | Not scored | 17 Mar, 2026 | npm graphlib-js |
Malicious release: Malicious code in revolut-merchant-widget (npm) GHSA-gpc2-rm7h-fpc4, MAL-2026-1481 | Malicious | Not scored | 16 Mar, 2026 | npm revolut-merchant-widget |
OpenClaw session transcript files were created without forced user-only permissions CVE-2026-33572, GHSA-vr7j-g7jv-h5mp | Medium | 0.1% | 16 Mar, 2026 | npm openclaw |
OpneClaw accepts unsanitized iMessage attachment paths which allowed SCP remote-path command injection CVE-2026-32917, GHSA-g2f6-pwvx-r275 | Critical | 2.0% | 16 Mar, 2026 | npm openclaw |
OpenClaw Telegram webhook request bodies were read before secret validation, enabling unauthenticated resource exhaustion CVE-2026-32980, GHSA-jq3f-vjww-8rq7 | High | 0.5% | 16 Mar, 2026 | npm openclaw |
OpenClaw bootstrap setup codes could be replayed to escalate pending pairing scopes before approval CVE-2026-32987, GHSA-63f5-hhc7-cx6p | Critical | 0.4% | 16 Mar, 2026 | npm openclaw |
OpenClaw Telegram media fetch errors exposed bot tokens in logged file URLs CVE-2026-32982, GHSA-xwcj-hwhf-h378 | High | 0.4% | 16 Mar, 2026 | npm openclaw |
Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries BIT-parse-2026-32728, CVE-2026-32728, GHSA-42ph-pf9q-cr72 | High | 0.3% | 16 Mar, 2026 | npm parse-server |
SandboxJS has an execution-quota bypass (cross-sandbox currentTicks race) in SandboxJS timers CVE-2026-32723, GHSA-7p5m-xrh7-769r | Medium | 0.2% | 16 Mar, 2026 | npm @nyariv/sandboxjs |
StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens CVE-2026-32638, GHSA-xvf4-ch4q-2m24 | Low | 0.4% | 16 Mar, 2026 | npm studiocms |
Uncontrolled memory allocation via crafted SVG dimensions in @dicebear/converter CVE-2026-29112, GHSA-v3r3-4qgc-vw66 | High | 0.4% | 16 Mar, 2026 | npm @dicebear/converter |
Malicious release: Malicious code in delta666 (npm) GHSA-4x9x-f5f2-fpw5, MAL-2026-1475 | Malicious | Not scored | 16 Mar, 2026 | npm delta666 |
Malicious release: Malicious code in alinet (npm) GHSA-6cmf-j596-2qj3, MAL-2026-1474 | Malicious | Not scored | 16 Mar, 2026 | npm alinet |
Malicious release: Malicious code in aesdecryptor (npm) GHSA-87mr-4wrw-h27g, MAL-2026-1473 | Malicious | Not scored | 16 Mar, 2026 | npm aesdecryptor |
Malicious release: Malicious code in supply-hx (npm) GHSA-qhvq-pqqm-67f9, MAL-2026-1477 | Malicious | Not scored | 16 Mar, 2026 | npm supply-hx |
Malicious release: Malicious code in jalalstealer (npm) GHSA-rvf8-cxqj-3hgq, MAL-2026-1476 | Malicious | Not scored | 16 Mar, 2026 | npm jalalstealer |
Malicious release: Malicious code in wordpecker-fx (npm) GHSA-vpgj-75r2-c557, MAL-2026-1478 | Malicious | Not scored | 16 Mar, 2026 | npm wordpecker-fx |
Malicious release: Malicious code in n8n-nodes-data-transform (npm) GHSA-247f-gpc6-j9v6, MAL-2026-1468 | Malicious | Not scored | 16 Mar, 2026 | npm n8n-nodes-data-transform |
Malicious release: Malicious code in n8n-nodes-format-utils (npm) GHSA-28fq-xgq3-mpwc, MAL-2026-1469 | Malicious | Not scored | 16 Mar, 2026 | npm n8n-nodes-format-utils |
Malicious release: Malicious code in n8n-nodes-json-helper (npm) GHSA-2grx-v7mh-7qrq, MAL-2026-1470 | Malicious | Not scored | 16 Mar, 2026 | npm n8n-nodes-json-helper |